PT-2023-24722 · WordPress · Valiano Unite Gallery Lite

Name of the Vulnerable Software and Affected Versions: Valiano Unite Gallery Lite plugin versions 1.7.61 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This vulnerability allows for malicious scripts to b...

PT-2023-27155 · WordPress · Postx

Name of the Vulnerable Software and Affected Versions: PostX WordPress plugin versions prior to 3.0.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2023-23295 · WordPress · Mailarchiver

Name of the Vulnerable Software and Affected Versions: MailArchiver plugin for WordPress versions up to, and including, 2.10.1 Description: The issue is related to Stored Cross-Site Scripting via an email subject due to insufficient input sanitization and output escaping. This allows...

PT-2023-24623 · WordPress · Woocommerce Box Office

Name of the Vulnerable Software and Affected Versions: WooCommerce Box Office plugin versions = 1.1.50 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by authenticated users with contributor or higher permissions. There is ...

PT-2023-23906 · WordPress · Rednao Donations Made Easy – Smart Donations

Name of the Vulnerable Software and Affected Versions: RedNao Donations Made Easy – Smart Donations plugin versions = 4.0.12 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This allows for malicious scripts to be injected into websites, potentiall...

PT-2023-26872 · Mitel · Mitel Mivoice Connect

Name of the Vulnerable Software and Affected Versions: Mitel MiVoice Connect versions through R19.3 SP3 22.24.5800.0 Description: A vulnerability in the Edge Gateway component could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to imprope...

PT-2023-5389 · D Link · D-Link D-View 8

Name of the Vulnerable Software and Affected Versions: D-Link D-View 8 version 2.0.1.28 Description: The issue is related to the use of a static key for protecting JWT tokens in user authentication, which can allow an attacker to bypass security restrictions and gain unauthorized access to...

PT-2023-27520 · Go-Libp2P · Go-Libp2P

Name of the Vulnerable Software and Affected Versions: go-libp2p versions prior to 0.27.4 go-libp2p versions prior to 0.30.0 Description: A malicious actor can store an arbitrary amount of data in a remote node's memory by sending the node a message with a signed peer record. This memory does not...

PT-2023-12359 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: FreeImage versions prior to 1.18.0 Description: The issue is related to a null pointer dereference in the ReadPalette function located in PluginTIFF.cpp. This function is part of the FreeImage library, which is used for image processing. The...

PT-2023-4822 · Libtiff +7 · Libtiff +7

Name of the Vulnerable Software and Affected Versions: libtiff versions prior to 4.4.0 Description: The issue is related to the function TIFFReadDirectory in the libtiff library, which can cause a denial of service when processing a crafted TIFF file. This can allow a remote attacker to exploit t...

PT-2023-7628 · Asustor · Asustor Data Master

Name of the Vulnerable Software and Affected Versions: ASUSTOR Data Master ADM versions 4.0.6.RIS1 and below ASUSTOR Data Master ADM versions 4.1.0 and below ASUSTOR Data Master ADM versions 4.2.2.RI61 and below Description: The issue is related to improper privilege management in ASUSTOR Data...

PT-2023-12357 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: FreeImage versions prior to 1.18.0 Description: The issue is related to a NULL pointer dereference vulnerability. It occurs via the FreeImage CloneTag function in FreeImageTag.cpp. Recommendations: For versions prior to 1.18.0, update to...

PT-2023-19663 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions prior to v767 Description: A Cross-site Scripting XSS issue in the Special Days component allows an attacker to steal the session cookie value of admin users with little user interaction. Recommendations: For versions pri...

PT-2023-28584 · WordPress · User Activity Log

Name of the Vulnerable Software and Affected Versions: User Activity Log WordPress plugin versions prior to 1.6.7 Description: The issue allows an attacker to manipulate the client IP address value retrieved by the plugin, potentially hiding the source of malicious traffic. This is due to the...

PT-2023-26767 · Chamilo · Chamilo

Name of the Vulnerable Software and Affected Versions: Chamilo versions 1.11 through 1.11.20 Description: A Cross Site Request Forgery CSRF issue allows a remote authenticated privileged attacker to execute arbitrary code. Recommendations: For Chamilo versions 1.11 through 1.11.20, update to a...

PT-2023-29269 · Wallabag · Wallabag

Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.6.3 Description: The issue is related to Cross-Site Request Forgery CSRF in the wallabag GitHub repository. This allows attackers to arbitrarily reset annotations, entries, and tags by sending a GET request to...

PT-2023-4780 · Notepad++ · Notepad++

Name of the Vulnerable Software and Affected Versions: Notepad++ versions 8.5.6 and prior Description: The issue is related to a heap buffer read overflow in the FileManager::detectLanguageFromTextBegining function. This may potentially be used to leak internal memory allocation information. The...

PT-2023-29208 · Inure · Inure

Name of the Vulnerable Software and Affected Versions: inure versions prior to build88 Description: The issue concerns a missing authorization in the GitHub repository hamza417/inure. Recommendations: For versions prior to build88, update to a version that includes the necessary authorization fix...

PT-2023-23616 · Fahad Mahmood · Fahad Mahmood Wp Docs

Name of the Vulnerable Software and Affected Versions: Fahad Mahmood WP Docs plugin versions prior to 1.9.9 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website, potentially allowi...

PT-2023-23613 · Theme Palace · Wp Education

Name of the Vulnerable Software and Affected Versions: Theme Palace TP Education plugin versions prior to 4.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects users with contributor or higher permissions. This allows for malicious scripts to be...